Oracle Communications BRM: Unauthenticated access to data via HTTP
Summary
Oracle Communications Billing and Revenue Management (BRM Server) versions 15.0 through 15.2 are affected by a vulnerability that allows an unauthenticated remote attacker with network access via HTTP to compromise the product. Successful exploitation can lead to unauthorized read access to critical data and to unauthorized modification or deletion of some data. No user interaction is required, and the CVSS 3.1 base score is 8.2.
Affected
- Oracle Communications Billing and Revenue Management (BRM Server) 15.0.0.0.0
- 15.0.1.0.0
- 15.1.0.0.0
- 15.2.0.0.0
Fixed in
Unknown. Check the Oracle Critical Patch Update Advisory for October 2026 for patch identifiers and fixed versions.
Workaround
Unknown.
Exploitation
- No evidence of exploitation in the wild or public proof of concept found at the time of research.
- One third-party aggregator lists the CVE as not in CISA KEV; this has not been verified against the CISA catalogue.
- SSVC assessment: Exploitation none, Automatable yes, Technical Impact partial.
Our recommendation
- Check whether any Oracle Communications BRM installation is in use, for example at an MSP or telecom customer.
- Open the Oracle October 2026 CPU advisory and apply the patch for the BRM Server version in use.
- Inventory BRM versions and confirm that no BRM HTTP interface is reachable from the internet.
- Review related October 2026 BRM CVEs together, including CVE-2026-101765 and CVE-2026-101763.
- Verify the CISA KEV status and the NVD analysis once completed.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Critical Patch Update Advisory – October 2026 www.oracle.com
- CVE record aggregator (vulners) vulners.com
- Strix CVE-2026-101758 details www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 15:31.
Original description (NVD)
Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: BRM Server). Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Billing and Revenue Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Communications Billing and Revenue Management accessible data as well as unauthorized update, insert or delete access to some of Oracle Communications Billing and Revenue Management accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.